# VunFisher Windows credentialed-assessment field acceptance receipt

Use one copy of this receipt for **one** authorized environment: workgroup, Active
Directory or Intune managed. A PASS in one environment does not establish the
other two. Use synthetic or approved test accounts and noncritical targets first.

Do not record passwords, password references that reveal a secret, MFA seeds,
recovery codes, activation codes, private keys, customer names, public IP addresses
or unredacted scan evidence. Store sensitive evidence in the approved private test
location and reference only a redacted filename plus SHA-256 here.

## 1. Receipt identity

- Receipt ID:
- Test date and timezone:
- Tester role:
- Organization or lab alias:
- Environment: `WORKGROUP` / `ACTIVE_DIRECTORY` / `INTUNE`
- VunFisher version and build:
- Windows package SHA-256:
- Target Setup Assistant version and package SHA-256:
- Scanner Windows edition/build:
- Target Windows edition/build:
- Target type: workstation / member server / other authorized non-DC target
- Network type: isolated lab / approved private LAN / approved VPN
- Authorization reference and expiry (no confidential content):

## 2. Required stop conditions

Mark `PASS`, `FAIL`, `NOT APPLICABLE` or `BLOCKED`, then add a short explanation.

| Check | Result | Redacted evidence or explanation |
|---|---|---|
| Written authorization covers scanner, target, account and time window |  |  |
| Target is not a domain controller |  |  |
| Target network profile is not Public |  |  |
| Scanner and target addresses are private/approved |  |  |
| Managed settings use the approved GPO/Intune route |  |  |
| Test account is approved and its required privilege is documented |  |  |
| No password was entered in the assistant, website, report or screenshot |  |  |

Any failed authorization or scope check is an overall `BLOCKED`; stop before
network collection.

## 3. Install, account, activation and persistence

| Test | Expected result | Result | Evidence reference |
|---|---|---|---|
| Verify downloaded ZIP | Complete SHA-256 matches the official value |  |  |
| Clean install | Installer completes and Desktop/Start shortcuts open `127.0.0.1:8787` |  |  |
| Create local scanner administrator | Local account works and is distinct from hosted portal account |  |  |
| Activate | Correct edition/term is shown without exposing the code |  |  |
| Enroll MFA | QR setup, next-code sign-in and one recovery-code test work |  |  |
| Restart VunFisher | Account, MFA, license and settings persist |  |  |
| Remember approved credential with DPAPI | Credential remains usable after app and Windows restart, or is recorded as not tested |  |  |
| Upgrade current build over prior test build | Database backup verifies and account/license/MFA/settings remain usable |  |  |

## 4. Target Setup Assistant acceptance

| Test | Expected result | Result | Evidence reference |
|---|---|---|---|
| Audit | Read-only observations match Windows state |  |  |
| Credential scan setup | Numbered guidance matches workgroup/AD/Intune ownership |  |  |
| Preview | Exact proposed changes and stop items are understandable |  |  |
| Apply once | Only approved settings change; firewall source scope is limited to the scanner |  |  |
| Unapproved source test | A third/unapproved computer cannot use the configured access path |  |  |
| Apply again | Operation is idempotent and creates no broad duplicate rule |  |  |
| Reboot | Approved configuration and checkpoint behavior remain explainable |  |  |
| Undo | Tool-owned settings return to the captured baseline without overwriting managed policy |  |  |
| Invalid/interrupted undo | Failure remains explicit and recoverable |  |  |

For AD or Intune, record the applicable policy object or deployment identifier by
nonconfidential alias. Do not claim local Apply/Undo controls organization policy.

## 5. Credential validation and scan

| Test | Expected result | Result | Evidence reference |
|---|---|---|---|
| Create Windows WinRM profile | Profile contains approved identity metadata and secret reference only |  |  |
| Load password in protected flow | Secret never appears in URL, log, database export, report or screenshot |  |  |
| Test Connection | Connectivity and target identity are correct |  |  |
| Authentication | `SUCCESS` for a passing credentialed test |  |  |
| Privilege | `ADMINISTRATOR` for full Windows inventory, or limitation is explicit |  |  |
| Evidence | `SUCCESS`, or `PARTIAL/FAILED/BLOCKED` identifies every unavailable family |  |  |
| Run assessment | Only the authorized target is contacted |  |  |
| Cancellation | Running assessment stops promptly and remains incomplete, not clean |  |  |
| Coverage | Assessed, observed, not applicable, disabled, blocked, failed and not selected remain distinguishable |  |  |
| Finding provenance | Finding retains TXVF Plugin ID/version, evidence and catalog provenance |  |  |
| Retest | Changed system produces attributable before/after evidence |  |  |
| Report export | Scope, authentication, coverage, findings, actions and retest are understandable |  |  |

## 6. Resource and usability observations

- Approximate target count:
- Scan duration:
- Peak scanner CPU/memory if measured:
- Cancellation latency if tested:
- Unexpected network, service or management impact:
- Installation or MFA problems:
- Credential setup problems:
- Findings or coverage that require more evidence:
- Report/usability observations:

## 7. Evidence index

List only redacted evidence. Use a private location and record its SHA-256.

| Evidence ID | Description | Redacted filename | SHA-256 |
|---|---|---|---|
| E-01 |  |  |  |

## 8. Acceptance decision

- Overall result: `PASS` / `FAIL` / `BLOCKED` / `PARTIAL`
- Passed scope:
- Failed or blocked checks:
- Security or operational impact:
- Required corrective action and owner:
- Retest required by:
- Tester sign-off and date:
- Reviewer sign-off and date:

`PASS` means the stated environment and build met this receipt's tests. It is not
certification, a guarantee of security, or evidence for untested operating systems,
management models, scale or network conditions.